ermac | ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff

General

Target
ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.bin
Size 3.6MB
Sample240305-12cslabh76
SHA256 ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff
MD5 5d391a83a4c4f2e11bd9af3fce04118b
SHA1 1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11
SHA512 d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27
SSDEEP 98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

hook

C2

http://127.0.0.1:3434

AES_key

Targets

- Target
  ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff.bin
- Size 3.6MB
- SHA256 ed0558cfbfbbffab7bfc500f5a458bf08178ab1a9ee08b79c7e9c1edb21442ff
- MD5 5d391a83a4c4f2e11bd9af3fce04118b
- SHA1 1e373a16fa1e27c17ac42ec9e2f638ee5d8dfd11
- SHA512 d4ff82ca5f835f360e0b1f2c312537890054d21ea168e7cbd628ca85a762ae6d0f628a24609525f95b7f7c8293d30354a1fd8f16e86cb536e1f1d0ea44ae6a27
- SSDEEP 98304:0ZQ6ESsYwdh29tDVnyFSQRH7JSaV2ShayXLe:JJPdQtVrCbL2ShaJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hook collection discovery evasion infostealer rat trojan
- Hook
  Hook is an Android malware that is based on Ermac with RAT capabilities.
  rat trojan infostealer hook
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection evasion
- Acquires the wake lock
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Input Injection

1

T1516

Credential Access

Discovery

System Network Configuration Discovery

1

T1422

Lateral Movement

Collection

Screen Capture

1

T1513

Command and Control

Exfiltration

Impact

Input Injection

1

T1516

Tasks

Sharing

General

Malware Config

Extracted

Targets

Hook

Makes use of the framework's Accessibility service

Acquires the wake lock

Reads information about phone network operator.

MITRE ATT&CK Mobile v15

Tasks

static1

behavioral1

behavioral2

behavioral3